Thanx, I dont know, can I do this or not. Because I dont know why at all the connection brokes. In new portgroup, there is connection, only not through the same path, not through ESXi uplink directly, but through VM where is Mikrotik firewall in L2 mode. I tested it with some other vmkernel adapter and its moved successfully. Only there was some strange delay when ping starts working. Now I dont know how Vmware processes this. When there is some delay, then maybe move operation get some timeout and becomes between heaven and hell. When I changed VLAN in the same portgroup, it also ends with error. Not rolled back but VM-s get new VLAN but vmkernel not. When I manually synced, then this should be fixed problem and end the uncompleted operation. It wasnt doed that. How vmware at all suggest to change portgroup or vlan then. Seems vcenter isnt at all able to do this. I think its too dangerous to disable this rollback when I dont know the reason why vmware wasnt allowed me to move portgroup.......Seems only solution, I still need to set up 2 virtual firewalls in chain (probably Kerio Control, its easy to use) and use SNAT and DNAT to force vCenter to connect into second vmkernel IP and then process all needed operations.